{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-38115",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-38115",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-07-03T08:35:23.750Z",
    "updatedAt": "2026-10-15T21:52:08.900Z",
    "importedAt": "2026-10-24T01:57:34.152Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "net_sched: sch_sfq: fix a potential crash on gso_skb handling",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: fix a potential crash on gso_skb handling\n\nSFQ has an assumption of always being able to queue at least one packet.\n\nHowever, after the blamed commit, sch->q.len can be inflated by packets\nin sch->gso_skb, and an enqueue() on an empty SFQ qdisc can be followed\nby an immediate drop.\n\nFix sfq_drop() to properly clear q->tail in this situation.\n\n\nip netns add lb\nip link add dev to-lb type veth peer name in-lb netns lb\nethtool -K to-lb tso off                 # force qdisc to requeue gso_skb\nip netns exec lb ethtool -K in-lb gro on # enable NAPI\nip link set dev to-lb up\nip -netns lb link set dev in-lb up\nip addr add dev to-lb 192.168.20.1/24\nip -netns lb addr add dev in-lb 192.168.20.2/24\ntc qdisc replace dev to-lb root sfq limit 100\n\nip netns exec lb netserver\n\nnetperf -H 192.168.20.2 -l 100 &\nnetperf -H 192.168.20.2 -l 100 &\nnetperf -H 192.168.20.2 -l 100 &\nnetperf -H 192.168.20.2 -l 100 &",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "a53851e2c3218aa30b77abd6e68cf1c371f15afe",
              "status": "affected",
              "versionType": "git",
              "lessThan": "c337efb20d6d9f9bbb4746f6b119917af5c886dc"
            },
            {
              "version": "a53851e2c3218aa30b77abd6e68cf1c371f15afe",
              "status": "affected",
              "versionType": "git",
              "lessThan": "b44f791f27b14c9eb6b907fbe51f2ba8bec32085"
            },
            {
              "version": "a53851e2c3218aa30b77abd6e68cf1c371f15afe",
              "status": "affected",
              "versionType": "git",
              "lessThan": "5814a7fc3abb41f63f2d44c9d3ff9d4e62965b72"
            },
            {
              "version": "a53851e2c3218aa30b77abd6e68cf1c371f15afe",
              "status": "affected",
              "versionType": "git",
              "lessThan": "9c19498bdd7cb9d854bd3c54260f71cf7408495e"
            },
            {
              "version": "a53851e2c3218aa30b77abd6e68cf1c371f15afe",
              "status": "affected",
              "versionType": "git",
              "lessThan": "b4e9bab6011b9559b7c157b16b91ae46d4d8c533"
            },
            {
              "version": "a53851e2c3218aa30b77abd6e68cf1c371f15afe",
              "status": "affected",
              "versionType": "git",
              "lessThan": "d1bc80da75c789f2f6830df89d91fb2f7a509943"
            },
            {
              "version": "a53851e2c3218aa30b77abd6e68cf1c371f15afe",
              "status": "affected",
              "versionType": "git",
              "lessThan": "82448d4dcd8406dec688632a405fdcf7f170ec69"
            },
            {
              "version": "a53851e2c3218aa30b77abd6e68cf1c371f15afe",
              "status": "affected",
              "versionType": "git",
              "lessThan": "82ffbe7776d0ac084031f114167712269bf3d832"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "4.16",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "4.16"
            },
            {
              "version": "5.4.295",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "version": "5.10.239",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "version": "5.15.186",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.1.142",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.94",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.34",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.15.3",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.15.*"
            },
            {
              "version": "6.16",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}